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January 17, 2019 


Michel Combes 

Chief Executive Officer and President 
Sprint Corp. 

6200 Sprint Parkway 
Overland Park, KS 66251 


John Legere 

Chief Executive Officer 

T-Mobile US, Inc. 

12920 Southeast 38th Street 
Bellevue, WA 98006 


Randall L Stephenson 

Chairman and Chief Executive Officer 

AT&T Inc. 

208 South Akard Street 
Dallas, TX 75202 


Hans Vestberg 
Chief Executive Officer 
Verizon Communications Inc. 
1095 Avenue of the Americas 
New York, NY 10036 


Dear Mr. Combes, Mr. Legere, Mr. Stephenson, and Mr. Vestberg: 

I write to request, again, that your companies reveal the extent of your sale of Americans’ 
location data. In addition, please provide me with aggregate statistics revealing the 
number of Oregonian customers whose location data you sold to third parties in each of 
the past five years. 

Last year, after an investigation by my office, I wrote to you to object to your practice of 
selling your customers’ location data without their knowledge or consent. Soon after, you 
pledged to reform your sale of location data. Last week, however, a Motherboard 
investigation demonstrated not only that you were still failing to protect your customers’ 
private information, but that location data can seemingly be purchased by stalkers, 
domestic abusers, and others, and for not very much money. 


In my May 8, 2018, letter to you raising concerns about this practice, I asked you to 
provide me with the following information: 

1. Please identify the third parties with which your company shares or has shared 
customer information, including location data, at any time during the past five 
years. For each third party with which you share information directly, please also 
include a list of the ultimate end users of that information, as well as all 
intermediaries. 

2. For each of the third parties identified in response to question one, please detail 
the types of customer information provided to them and the number of customers 
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whose information was shared. For each of these, please detail whether the third 
party provided proof of customer consent, and if so, how the third party 
demonstrated that they had obtained customer consent. 

3. Please describe in full your process, if any, for determining that each third party 
identified in response to question one has obtained appropriate customer consent 
before your company shared that customer’s information with them. Specifically, 
please describe what criteria and processes your company uses to review claims 
and evidence that a third party has obtained consent. 

4. Please describe any incidents known to your company, or uncovered during your 
responses to the above, in which a third party with which your company shared 
customer data misrepresented that they had customer consent. 

Although you responded to my letter, none of you provided complete answers to these 
questions. Despite follow-up requests by my office, your companies continue to refuse to 
identify the companies with whom you shared your customers’ private data, citing 
contractual commitments to protect the privacy of those companies. 

It is telling that you and your lawyers seem to prioritize corporate secrecy over 
transparency about how your customers’ information has been shared without their 
knowledge. You should end this profiteering immediately and own up to your mistake at 
having let it go on for this long. 

Congress has a responsibility to the American people to investigate this matter. To that 
end, please provide me with complete answers to the above questions by February 15, 
2019. If you have any questions about this request, please contact Chris Soghoian in my 
office. 


Sincerely, 


ROn vv y uvu 

United States Senator 




